Support default Pundit policy class.

There are situations where to have default Pundit policy defined which will handle all cases here dedicated policy could not be found. Some of those cases I described in issue #3319. This PR introduces new ActiveAdmin setting `pundit_default_policy ` which handles authorization when Pundit can't find dedicated Policy class for resource.
It's weird that `pundit_default_policy` accepts a class, and `cancan_ability_class` accepts a string. I'm not sure which is better, but in general it'd be good to have a consistent DSL.